61 matches found
EUVD-2026-85546
Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...
CVE-2026-49223
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
EUVD-2026-61039
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
PT-2026-77204
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product review.sql queries accept...
CVE-2026-16041: Missing Authorization
The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attacker-chosen reviewer name, email and star rating on stores...
CVE-2026-12560: Improper Neutralization of Input During Web Page Generation
The Editorial Rating – Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
WordPress Editorial Rating – Product Review & Rating System plugin <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Supoj Polsawas sp0x5ec in WordPress Plugin Editorial Rating – Product Review & Rating System versions = 4.0.5...
CVE-2025-15248
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...
EUVD-2025-205775
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...
CVE-2025-15248
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...
CVE-2025-15248 sunhailin12315 product-review 商品评价系统 Write a Review cross site scripting
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...
CVE-2025-15248 sunhailin12315 product-review 商品评价系统 Write a Review cross site scripting
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...
CVE-2025-15248
The CVE-2025-15248 entry concerns sunhailin12315 product-review 商品评价系统’s Write a Review component. The vulnerability is a cross-site scripting flaw triggered by manipulating the content argument, enabling remote exploitation. A PoC/public exploit exists. The affected version set is up to 91ead689...
CVE-2025-15248: Improper Neutralization of Input During Web Page Generation
A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the component Write a Review. Performing manipulation of the argument content results in cross site scripting. The attack is possible to be...
product-review 代码注入漏洞
product-review is a product review system by sunhailin12315 individual developer. A code injection vulnerability exists in product-review, which stems from the incorrect manipulation of the parameter content in the component Write a Review, which could lead to a cross-site scripting attack...
PT-2025-54174
Name of the Vulnerable Software and Affected Versions sunhailin12315 product-review 商品评价系统 versions up to 91ead6890b4065bb45b7602d0d73348e75cb4639 Description A security flaw exists in the sunhailin12315 product-review 商品评价系统. The issue is related to cross site scripting, which can be triggered b...